Random Password Generator
About Random Password Generator
Pick a length, tick the character types, generate. The randomness comes from crypto.getRandomValues, the browser's cryptographic source, not Math.random.
Two things most generators get wrong, handled here:
- Every selected type appears at least once. Generators that draw uniformly often skip a type on short passwords: with 6 characters and three types ticked, there is a fair chance no digit shows up at all.
- Look-alike characters (o O 0 l I 1) can be excluded, which helps when the password will be typed by hand or read out over the phone.
After picking, the characters are shuffled, so the guaranteed ones do not always sit at the front.
What length to pick
12 is a sensible floor for anything you care about, 16 or 20 where the site allows it. Length beats symbol soup: 20 characters of letters and digits outranks 8 characters stuffed with symbols.
The minimum here is 4, only because one character of each ticked type has to fit. Do not actually use 4.
Where these passwords belong
Anywhere a password manager will remember it for you: new accounts, API keys that accept symbols, guest Wi-Fi. If you need to memorize it or type it on a TV remote, use a passphrase instead. This tool makes passwords no human should have to remember.
Frequently asked questions
Is Math.random good enough for passwords?
For shuffling a playlist, yes. For credentials, no: it is predictable in principle. This generator uses crypto.getRandomValues with rejection sampling, which is what password generators should use.
Why guarantee one character of each type?
Without it, short passwords sometimes miss a type you explicitly asked for. With it, the minimum length has to be the number of selected types, which is the floor this tool enforces.
Should I exclude look-alike characters?
If the password will ever be typed by hand or read aloud, yes. If it lives only in a password manager and gets pasted, keep them; a larger alphabet is marginally stronger.
Can I trust this over my password manager's generator?
Both are fine, and yours may integrate better: it flags reused passwords and fills forms. Use whichever you will actually keep using.
